Help! Trojan.BrowserHijack / malware keeps coming back even deleting it.

[jansendale]

I noticed it when my chrome suddenly closes and the time I troubleshoot and check my extensions, there I found an extension added named vHomeScan. Been googling this but can't find what is it about and I thought this is a malware. I also found out there's a strange hidden folder in my C:\ProgramData and there are 2 unnamed processes in my task manager in which after I deleted them and after a minute/s they will come back. I always delete the folder when it comes back as its files are detected as malwares. The problem is I can't get them removed. Please help!

[TwinHeadedEagle]

Hi,

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

[jansendale]

Hi TwinHeadedEagle, thank you for your response. Please see the zip file in the attachments.

mbst-grab-results.zip

[TwinHeadedEagle]

Download FRST from this link:

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Download attached Filxist.txt, it has to be at the same location as FRST tool, you can move them both to the Desktop.

Start FRST and click Fix. Allow reboot.

Attach Fixlog.txt and Date|Time ZIP archive found on your desktop in your next reply.

Fixlist.txt

[AdvancedSetup]

You already have FRST on the system. It is located here:  C:\Users\Sen\Downloads\FRSTEnglish.exe

Save the FIXLIST.TXT file to your C:\Users\Sen\Downloads folder. Then run FRSTEnglish.exe and click the FIX button as requested.

Then post back the log and zip file

 

[jansendale]

Here are the files. Please see attached.

24_06.2021_15_14.35.zip Fixlog.txt

[TwinHeadedEagle]

Hi,

I am confident you're good to go, can you run one more scan with MalwareBytes and report back?

[jansendale]

All good! No malwares found and the hidden strange folder is gone as well as the unnamed processes on the task manager. Thank you so much! I very appreciate your help! 😄

[TwinHeadedEagle]

You are very welcome.
You can rename FRST to uninstall and run it. It will clean up after itself.

[TwinHeadedEagle]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you